That's an interesting paper! Some points I thought about while reading it:

* Many environments (PHP, Perl+CGI.pm) accept both POSTed and GETted data. At
least in some circumstances, they just put it in a structure for incoming data
without much regard for what HTTP method was used.